Batch records, QC-gated release, environmental monitoring, a quality system with Part 11 signatures, and unit-level traceability — the operational record a 503B has to be able to show an FDA investigator.
A 503B outsourcing facility is a drug manufacturer that compounds. It registers with FDA, is inspected by FDA, and is held to current good manufacturing practice. That changes what the software underneath has to do: it must make the batch record, the release decision, the environmental log and the quality system into records that exist because the work was done — not documents somebody fills in afterwards. This page explains what a 503B needs, what the rules say, and exactly how Pharmacy Flow handles each piece.
What a 503B is, under the statute
Section 503B was added to the Federal Food, Drug, and Cosmetic Act by the Drug Quality and Security Act of 2013. An outsourcing facility is a compounder that elects to register with FDA, pays an annual establishment fee, reports the products it compounds to FDA twice a year, reports adverse events, compounds under the direct supervision of a licensed pharmacist, and is subject to cGMP and risk-based FDA inspection. In exchange it may compound without a patient-specific prescription and sell to healthcare facilities and prescribers for office use. It also carries specific labeling duties: the label must state that the product is a compounded drug, carry the lot or batch number, a beyond-use date, storage and handling instructions, and the facility's name and address, among other elements listed in the statute.
The practical consequence is that a 503B is inspected against 21 CFR 211, not just a USP chapter. Investigators ask for the master and batch production records (211.186, 211.188), the laboratory release records (211.165), the environmental monitoring data for aseptic operations (211.42, 211.113), the investigation of any discrepancy or out-of-specification result (211.192), the change history of procedures (211.100), and the distribution records that would let you execute a recall (211.150). If you are still deciding between the two models, our guide to 503A vs 503B covers the trade-offs, and the 503B Launch Playbook walks the build itself.
Batch records and lot genealogy
In Pharmacy Flow a batch is planned from an approved formulation. The planner lists the components, the quantity of each raw-material lot that will be consumed, and the finished quantity expected. When the batch is created, the platform records the consumption of each raw lot with the quantity taken — a table of batch consumptions, not a free-text note — and creates the finished lot in Quarantine with the batch itself In Process. Nothing about that finished lot is sellable yet.
Every batch starts from an approved formulation
The planner pulls the formulation's bill of materials and offers only raw-material lots that are Available — lots that have been QA-released after receipt. A lot still in quarantine, expired, or rejected cannot be selected. The pharmacist and the facility are recorded on the batch, and the batch number comes from a database sequence with a unique index, so two batches can never share a number.
Formulation changes go through change control and an approval signature before a new version can be used in a batch.
Beyond-use dating is where a lot of batch software is quietly wrong. Pharmacy Flow takes the BUD from the formulation and then caps it at the earliest expiry date among the raw-material lots consumed — the database computes the minimum, and the finished lot cannot carry a BUD later than any component that went into it. That single rule removes a whole class of labeling and stability findings.
Batches list: each row shows the batch status, its finished lot, the QC state, and who released it.
QC-gated release, enforced in the database
Release is the moment an investigator will look at most closely, so the interlock lives in Postgres rather than in a screen. The finished lot's lifecycle is a fixed graph of allowed transitions, and a trigger rejects any update that is not in the graph. For a finished lot to move from Quarantine to Available, three things must all be true: at least one QC test exists for the lot; every QC test on the lot has a status of Pass; and a QC release signature (who released it, and when) is on the record. If any one is missing the update fails with an error naming the lot, whatever role the user holds and whichever screen or API they used.
1
Batch created In Process
Finished lot inserted in Quarantine. QC tests are created as Pending for every test the formulation specifies.
2
Results recorded
Each test is recorded with its result and specification. A result other than Pass leaves the lot locked; an OOS result is raised as a deviation with the lot linked.
3
Release signed
A user holding the qa.release permission signs the release. The signature is a Part 11 electronic signature: identity from the session plus a fresh password re-authentication at the moment of signing.
4
Lot Available
Only now can the lot be picked for an order. Every status change was written to the lot's status history with the actor and timestamp.
A lot can go back to Quarantine from Available (with a hold reason), and Rejected and Consumed are terminal. A lot cannot be marked Consumed while it still has quantity. Status changes on lots and orders go through database functions that check the caller's permission; the tables themselves refuse direct status edits. This is the difference between software that displays a quality process and software that enforces one — see how the controls are built.
The QMS module covers the records 21 CFR 211 expects a manufacturer to keep, linked to each other and to the lots and batches they concern.
!
Deviations
Categories: temperature excursion, OOS result, label error, fill discrepancy, equipment, documentation, process, environmental. Severity Critical/Major/Minor; status Open → Investigating → Closed; linked lot and linked CAPA.
⟳
CAPA
Corrective or preventive, opened from a deviation or standalone. Status Open → In Progress → Verification → Closed, so effectiveness verification is a distinct step, not a checkbox.
⇄
Change control
Formulation, supplier, process, equipment or document changes, with review and approval signatures before the change takes effect.
▭
Document control
Controlled documents and SOPs with versioning and a signature-required flag; an approval signature is captured as a Part 11 record.
✍
Signatures
Signature meanings are fixed (Reviewed, Approved, Released, Verified, Witnessed, Rejected). Signing requires re-entering the password; the approvals table cannot be updated or deleted by application roles.
↯
Event log
Every material action writes an event with actor, timestamp and summary. Events, approvals and the audit log are append-only for application users.
Quality dashboard: open deviations by severity, CAPAs by stage, change controls pending signature, and environmental action-limit breaches.
For the detail of how the signature ceremony maps to Part 11 §11.50, §11.70 and §11.200, read our 21 CFR Part 11 explainer.
Environmental monitoring
Environmental readings are recorded per room with the ISO class, the metric (viable particulate, non-viable at ≥0.5 µm and ≥5.0 µm, temperature, humidity, differential pressure), the reading, the unit and the action limit. Status is derived from the numbers, not chosen by the user: over the action limit is Action; within 10% of it is Alert; otherwise Pass. An Action reading links to the environmental deviation category so the investigation is opened against the reading that triggered it. Readings can be filtered by room, metric, status and period, and exported.
If you handle hazardous drugs, the platform tags the material as hazardous and the putaway engine sends the lot to a segregated hazmat location; our USP <800> checklist covers the rest of that programme. Sterile-specific detail is on the sterile compounding page.
Serialization, shipping and per-unit recall
At fill, each unit receives a serial and a GS1 DataMatrix label encoding GTIN (01), lot (10) and serial (21). Packed parcels are aggregated into cartons and pallets carrying an SSCC on a GS1-128 label. Each fill, pack, verify and ship step writes an EPCIS-style event with the read point, business step and disposition, so a unit's journey is a query on its serial. Pack verification is the ship interlock: an order cannot move to Shipped unless a verify scan has been recorded, and the database rejects the transition otherwise.
Carrier scans arrive by webhook and are stored one row per event, de-duplicated on the carrier's event id, so a retry never fabricates a second delivery. A recall is initiated from a lot's trace graph: the platform lists every shipment and every dispensed unit of that lot, creates a recall record with a 21 CFR 7 classification, flags each unit Recalled, and tracks per-unit disposition until effectiveness is reconciled. A unit flagged Recalled can no longer pass the fill interlock. The serialization and DSCSA explainer goes into the standards.
Recall management: units reconciled against units affected, per recall and per lot.
Selling office stock: partner portal and ordering API
A 503B's customers are clinics, surgery centres and health systems. The partner portal lets each of them submit orders, see order and shipment status, manage standing orders, and view and print invoices. Larger partners integrate through the ordering API: an API key identifies the partner and brand; a client order id makes each request idempotent, so a retried request returns the existing order instead of creating a duplicate; and every request passes the ship-to state licence gate before it is accepted. That gate fails closed — no licence on file for the state, an expired or inactive one, or a controlled product into a state that does not permit it all place the order on hold rather than letting it through. Details are on the ordering API page and the partners page.
See the release interlock on your own formulation
Bring one formulation and one QC panel. We will create a batch, fail a test, and show you the database refuse the release — then pass it and sign.
Facilities are first-class: each has its own locations, capacity and the product families it is qualified to compound. Orders are routed to a facility by capability and ship-to state, with contractual pinning where a customer must be served from one site. Inter-site transfers are two-sided — the sending facility releases the lot and the receiving facility counts what arrived. Permissions are rows in the database, not switches in the UI: a Technician cannot release a lot because the release function checks for qa.release, which that role does not hold. Pharmacist and QA hold release; QA additionally holds formulation approval and QMS sign-off.
What the platform enforces versus what a manual system relies on people to remember.
Capability
Pharmacy Flow
Spreadsheets + paper batch records
Release blocked until every QC test passes
✓
—
BUD capped at earliest component expiry, automatically
Partner ordering with idempotency and licence gate
✓
—
Who this is for
Existing 503B
Replacing a paper batch record or a generic ERP whose release step is a status dropdown. You need the interlocks and the history, not another dashboard.
503A adding a 503B
Running both models in one organisation. The same platform runs prescription-driven work for the 503A and batch-driven work for the 503B, with separate facilities.
New facility
Standing up a 503B and wanting the quality system live before the first engineering batch. Start with the launch playbook.
Pharmacy Flow also runs the commercial side — finance, receivables, product analytics — and gives you the supplier directory and RFQ marketplace for sourcing bulk substances and components. See the full platform, the inventory module, and how it compares to other pharmacy systems.
Frequently asked questions
Does Pharmacy Flow produce a cGMP batch record?+
It produces the electronic record of a batch: the approved formulation version, the raw-material lots consumed with quantities, the finished lot and its quantity, the BUD (capped at the earliest component expiry), the QC tests with results and specifications, the release signature, and the status history. Whether that record satisfies 21 CFR 211.188 for your process is a judgement your quality unit makes against your procedures; the platform gives you the data structure and the interlocks.
What exactly stops a lot being released early?+
A database trigger on the finished-lot table. The transition from Quarantine to Available is rejected unless at least one QC test exists for the lot, every QC test has status Pass, and a QC release signature is recorded. This applies to every path — UI, API, or direct database client using an application role.
Is the electronic signature 21 CFR Part 11 compliant?+
The signature is designed to the Part 11 requirements: it is bound to a named user, requires a fresh password re-authentication at the moment of signing (two distinct components, §11.200), records the signature meaning, signer, role and timestamp (§11.50), is linked to the record it applies to (§11.70), and is stored in a table that application roles cannot update or delete. Part 11 compliance is a property of your validated system and procedures as a whole, so we say designed to support rather than certified.
Can we run a 503A pharmacy and a 503B facility on one account?+
Yes. Facilities are separate entities with their own locations, capabilities and routing rules, and orders can be prescription-driven or batch-driven. Reporting can be viewed per facility or across the organisation.
Does it handle environmental monitoring for sterile suites?+
Yes. Readings are recorded per room and ISO class for viable and non-viable particulates, temperature, humidity and differential pressure, with the action limit stored on each reading and the Pass/Alert/Action status derived from it. Action readings link to the environmental deviation category.
How does recall work at the unit level?+
Every dispensed unit carries a serial. Initiating a recall from a lot's trace creates a recall record with a 21 CFR 7 class, lists every shipment and unit of that lot, marks each unit Recalled and tracks per-unit disposition until the recall is reconciled. Recalled units fail the fill interlock if scanned again.
Is Pharmacy Flow itself validated for cGMP use?+
We provide the system documentation, the change history and the test evidence needed to support your computer system validation. Validation for intended use (IQ/OQ/PQ) is performed by you or your validation partner against your procedures; we do not claim a blanket certification.
A working platform, not a slide deck. Book a walkthrough and we'll run a real order from intake to carrier lane — or explore the public directory first, no account needed.
